periodic: Support RFC 5424 syslog timestamps

This is based on an initial implementation by michaelo in
https://reviews.freebsd.org/D54361.

PR:		270497
Reported by:	michaelo
Reviewed by:	michaelo
Tested by:	michaelo
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D54606

usr.sbin/periodic/etc/daily/460.status-mail-rejects

@@ -36,8 +36,15 @@ case "$daily_status_mail_rejects_enable" in
 	    echo
 	    echo Checking for rejected mail hosts:
 
-	    yesterday=$(date -v-1d '+%b %e')
-	    today=$(date '+%b %e')
+	    # Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps.
+	    today_3164="$(date '+%b %e ')"
+	    today_5424="$(date -I)"
+	    prefix_today="(^${today_3164}|^<[0-9]{1,3}>1 ${today_5424}T)"
+
+	    yesterday_3164="$(date -v-1d '+%b %e ')"
+	    yesterday_5424="$(date -v-1d -I)"
+	    prefix_yesterday="(^${yesterday_3164}|^<[0-9]{1,3}>1 ${yesterday_5424}T)"
+
 	    n=$(($daily_status_mail_rejects_logs - 2))
 	    rc=$({
 		while [ $n -ge 0 ]
@@ -61,7 +68,7 @@ case "$daily_status_mail_rejects_enable" in
 		    n=$(($n - 1))
 		done
 		cat /var/log/maillog
-	    } | sed -Ene "/^$today/q" -e "/^$yesterday/{"'
+	    } | sed -En -e "/$prefix_today/q" -e "/$prefix_yesterday/{"'
 		    s/.*ruleset=check_relay,.* relay=([^,]+), reject=([^ ]*).*/\2 check_relay \1/p
 		    t end
                     s/.*ruleset=check_rcpt,.* arg1=<?([^>,]+).* reject=([^ ]+) .* ([^ ]+)/\2 check_rcpt \1 \3/p

usr.sbin/periodic/etc/security/800.loginfail

@@ -39,7 +39,14 @@ fi
 
 LOG="${security_status_logdir}"
 
-yesterday=`date -v-1d "+%b %e "`
+# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps.
+yesterday_3164="$(date -v-1d '+%b %e ')"
+prefix_3164="^${yesterday_3164}"
+
+yesterday_5424="$(date -v-1d -I)"
+prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T"
+
+prefix="(${prefix_3164}|${prefix_5424})"
 
 catmsgs() {
 	find ${LOG} -name 'auth.log.*' -mtime -2 |
@@ -57,7 +64,7 @@ if check_yesno_period security_status_loginfail_enable
 then
 	echo ""
 	echo "${host} login failures:"
-	n=$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" |
+	n=$(catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 fi

usr.sbin/periodic/etc/security/900.tcpwrap

@@ -39,7 +39,14 @@ fi
 
 LOG="${security_status_logdir}"
 
-yesterday=`date -v-1d "+%b %e "`
+# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps.
+yesterday_3164="$(date -v-1d '+%b %e ')"
+prefix_3164="^${yesterday_3164}"
+
+yesterday_5424="$(date -v-1d -I)"
+prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T"
+
+prefix="(${prefix_3164}|${prefix_5424})"
 
 catmsgs() {
 	find ${LOG} -name 'messages.*' -mtime -2 |
@@ -57,7 +64,7 @@ if check_yesno_period security_status_tcpwrap_enable
 then
 	echo ""
 	echo "${host} refused connections:"
-	n=$(catmsgs | grep -i "^$yesterday.*refused connect" |
+	n=$(catmsgs | egrep -ia "${prefix}.*refused connect" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 fi